feat(07-06): cover the session sequence and each token scope

Register through logout is one in-process flow, and token mint accepts read, write, ai, and the two-scope combination.

Co-authored-by: Cursor <cursoragent@cursor.com>

sequence_test.go

@@ -0,0 +1,59 @@
+package user
+
+import (
+	"encoding/json"
+	"net/http"
+	"testing"
+
+	"git.golem15.com/golem15/fonoteka/plugins/golem15/user/controllers"
+)
+
+func TestSessionSequence(t *testing.T) {
+	app, _ := sessionApp(t, "0s")
+	disableRegisterThrottle(t, app)
+
+	reg := postRegister(t, app, "203.0.113.10", `{"email":"sequence@example.test","password":"correct-horse","password_confirmation":"correct-horse","name":"Seq"}`)
+	if reg.Code != http.StatusOK {
+		t.Fatalf("register %d %s", reg.Code, reg.Body.String())
+	}
+	token := tokenFrom(t, reg.Body.Bytes())
+
+	fetch := bearer(t, controllers.Fetch(app), http.MethodGet, "/_user/api/v1/fetch", token)
+	if fetch.Code != http.StatusOK {
+		t.Fatalf("fetch %d %s", fetch.Code, fetch.Body.String())
+	}
+	updated := bearerJSON(t, controllers.Update(app), "/_user/api/v1/update", token, `{"name":"Seq","surname":"User","email":"sequence@example.test"}`)
+	if updated.Code != http.StatusOK {
+		t.Fatalf("update %d %s", updated.Code, updated.Body.String())
+	}
+	changed := bearerJSON(t, controllers.ChangePassword(app), "/_user/api/v1/change-password", token, `{"current_password":"correct-horse","password":"parity-alice-next","password_confirmation":"parity-alice-next"}`)
+	if changed.Code != http.StatusOK {
+		t.Fatalf("change-password %d %s", changed.Code, changed.Body.String())
+	}
+	refreshed := bearer(t, controllers.Refresh(app), http.MethodPost, "/_user/api/v1/refresh", token)
+	if refreshed.Code != http.StatusOK {
+		t.Fatalf("refresh %d %s", refreshed.Code, refreshed.Body.String())
+	}
+	next := tokenFrom(t, refreshed.Body.Bytes())
+	out := bearer(t, controllers.Logout(app), http.MethodPost, "/_user/api/v1/logout", next)
+	if out.Code != http.StatusOK {
+		t.Fatalf("logout %d %s", out.Code, out.Body.String())
+	}
+	again := bearer(t, controllers.Fetch(app), http.MethodGet, "/_user/api/v1/fetch", next)
+	if again.Code != http.StatusUnauthorized {
+		t.Fatalf("reused fetch %d %s", again.Code, again.Body.String())
+	}
+}
+
+func tokenFrom(t *testing.T, raw []byte) string {
+	t.Helper()
+	var body map[string]any
+	if err := json.Unmarshal(raw, &body); err != nil {
+		t.Fatal(err)
+	}
+	token, _ := body["token"].(string)
+	if token == "" {
+		t.Fatalf("token missing: %s", raw)
+	}
+	return token
+}